Privacy Policy

1.1Clausebook ApS (Danish company number (CVR): to be confirmed before launch), street address to be confirmed before launch, Copenhagen, Denmark, is the controller of the personal data processed through clausebook.co. Contact: privacy@clausebook.dk.

1.2Because we are a company established in Denmark, the EU General Data Protection Regulation (GDPR) applies to everything we do with personal data, wherever our customers live (Art. 3(1)), so its rights are yours in the United States too. This policy also gives the information California’s Online Privacy Protection Act asks of a website (Bus. & Prof. Code § 22575(b)).

1.3The California Consumer Privacy Act applies only to a business above one of its thresholds: more than $25,000,000 in annual revenue (as adjusted under the Act), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or earning half its revenue from selling or sharing personal information (Civ. Code § 1798.140(d)). Clausebook is below all three, so we do not claim to be covered by it. Texas’s Data Privacy and Security Act does not apply to a small business as the U.S. Small Business Administration defines it (Bus. & Com. Code § 541.002(a)(3)). Either way, this policy gives the information the Texas Act asks a privacy notice to give (§ 541.102), and your requests under § 5 are handled as it describes.

1.4This policy takes effect on the date at the top of this page. Every material change is described in the box at the top, with its version and its date; if a change affects how we use data we already hold about you, we tell you by email before it takes effect.

2.1Document data: the names, addresses and other details you type into a guided setup. We use them to generate your document. Legal basis: the contract (GDPR Art. 6(1)(b)). We never ask for a Social Security number, a driver’s license, ID or passport number, or a bank account number: where a document needs one, it prints a line to fill in by hand.

2.2Order data: your email address, what you bought and when, the consent you gave at checkout (its words and its time), any cancellation you send us, and your receipts. Your card details go straight to Stripe and never reach our servers. If you type your email in the checkout and leave before paying, we keep that email and the name of the document you were drafting (§ 3.2). Legal basis: the contract, our legal duty to keep accounting records under the Danish Bookkeeping Act, and our legitimate interests in proving your consent and in seeing which checkouts are left unfinished (Art. 6(1)(b), (c) and (f)).

2.3Technical data: your IP address and browser details are processed in server logs and to protect our forms against abuse, and a message sent through the contact form is stored with the sender’s IP address. Our pages load their typefaces from Google Fonts, so your browser also sends your IP address to Google when it fetches them. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f)). We use no analytics or advertising service.

2.4We do not sell personal data, and we do not share it for advertising or give it to anyone for their own marketing. We do not use the contents of your documents for marketing, profiling or training of any kind, we make no decisions about you by automated means, and we send no marketing emails — only the emails your order, your cancellation and your letters call for.

2.5Do Not Track: we do not collect information about your online activities over time or across other websites, so a browser’s “Do Not Track” signal changes nothing here — there is nothing to switch off. Other parties: Stripe, which runs the payment form on our checkout page, may collect information about your device and browser across the websites that use Stripe, to process payments and detect fraud, under its own privacy policy; Google receives your IP address when your browser fetches our typefaces. No other party tracks you across websites through our pages.

2.6What you must give us: an email address, because that is where your document and your receipt go — without it we cannot sell you a document. Each setup marks the few answers it needs to draft the document; anything else you can leave as a blank line to fill in by hand.

3.1Orders and the documents bought with them: five years from the end of the financial year of the order, because the Danish Bookkeeping Act (§ 12) requires us, as a Danish company, to keep our accounting records that long — and the record of your consent to a subscription for at least three years, or until one year after the subscription ends if that is later (Bus. & Prof. Code § 17602(a)(6)). There is no account to delete: your order link stays valid for the same period, and you can ask us to remove the document itself sooner.

3.2An email typed into the checkout without a purchase is deleted after 30 days; if you complete the purchase, it is removed from that list right away.

4.1We share personal data only with the processors we need to run the Service, under data processing agreements — and with an authority only where the law requires it.

4.2Current processors: payments (Stripe), transactional email (Resend), hosting (Vercel) and database (Supabase, EU region). Your browser also fetches our typefaces from Google Fonts (§ 2.3). An up-to-date list is available on request.

5.1You can ask whether we hold personal data about you and for a copy of it, and have it corrected, deleted, restricted or sent to you in a portable form, or object to our use of it — by writing to privacy@clausebook.dk or through the contact form. We answer within one month, free of charge, and never ask you to create an account for it.

5.2If we decline a request, we tell you why within that month, and you can ask us to reconsider it by replying: we answer that appeal in writing within 60 days. You can complain at any time to Datatilsynet, the Danish Data Protection Agency, which supervises us; if you live in Texas, you can also complain to the Texas Attorney General.

6.1Your data is stored in the European Union. Where a processor transfers personal data to a country outside the European Economic Area — the United States, for example — we rely on an adequacy decision of the European Commission or on the safeguards of GDPR Article 46, such as standard data protection clauses, and you can ask us for a copy of them.